fix: preserve legacy Telegram token upgrades

[shivros]

Summary

• Preserve TELEGRAM_BOT_TOKEN as a deprecated, default-Telegram-only upgrade fallback when the canonical IRIS_TELEGRAM_BOT_TOKEN is absent.
• Make canonical configuration authoritative, emit a secret-safe structured migration warning for fallback use, and cover environment precedence/containment.
• Update Docker, Compose, and TOML documentation to teach the canonical variable and migration path.

Verification

• cargo test -p iris-providers (104 passed)
• cargo build --all-targets
• cargo test --all-targets (217 passed)
• cargo clippy --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo run -p iris-codegen --bin iris-codegen -- check
• git diff --check

Closes COD-455.

[shivros]

🤖 Automated Review Panel

Reviewer A — GPT-5.6-terra

Finding fixed: the Docker quick-start passed the old host variable into the canonical container environment. Updated it to source ${IRIS_TELEGRAM_BOT_TOKEN} so new deployments are not taught the deprecated name.

Reviewer B — independent review

APPROVE. The fallback is restricted to the default Telegram instance; canonical precedence, secret-safe structured warning, tests, and documentation satisfy the ticket.

After the Reviewer A correction, the complete required verification suite passed again: provider tests (104), workspace tests (217), build, strict clippy, formatting, codegen freshness, and diff check. The known imap-proto future-incompatibility warning remains pre-existing.

[shivros]

Auto-Merge Gate approval

Confidence: 0.94

The implementation directly satisfies COD-455: it preserves legacy-only default Telegram startup, gives IRIS_TELEGRAM_BOT_TOKEN canonical precedence, confines the fallback to Telegram/default instance, emits a credential-safe structured warning, and updates all checked-in configuration guidance. The focused tests cover legacy-only, canonical-only, precedence, and non-Telegram containment.

Checks observed: CI Test, Format Check, Clippy, Secret Scan, Dependency Audit, and Creed context drift all completed successfully.

Scope limits: three files; configuration compatibility and documentation only. No unresolved reviews, manual-review marker, deployment cutover, or credential value exposure was found.

— Auto-Merge Gate